Re: security issues.....

[<nospam [at] mckay.com>]

> I THEN CARRIED OUT THE TEST ON PORTS AND FOUND WIN98 TO BE ACCEPTABLE
> BUT LINUX FAILED ON SEVERAL PORTS.....
> PORT 21-FTP
> PORT 23-TELNET
> PORT 79-FINGER
> PORT 110-POP3

Ross, what distribution are you using and what version? This security
program you've got may just be paranoid and might just be complaining
about you running those services at all.. in my opinion if that is the
case the security program isn't particularly useful however more clever
than that; there are certainly vulnerabilities in many FTP daemons which
can be exploited to gain unauthorized root access to your machine, however
these vulnerabilities are generally picked up quite quickly and patched so
as long as you have a non-exploitable version of the FTPd you'll be fine.

Altough there have been exploits which gained root remotely through
telnetd (cracklib for example) I have not heard of any recently so unless
you are running a VERY old distribution there aught not to be any problems
with telnet.

Finger is usually fairly harmless although there have been a few DOS
attacks with it, for example if you use the command finger
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@hostname that would (on older fingerds)
cause fingerd to spawn a new finger client and server for each  [at] . If you
put a lot of  [at] s you could exhaust the memory and sometimes crash inetd but
that's just a silly little attack and hasn't worked on any major
distribution of linux in years (although it probably still works on many
other unixes). Most people dissable fingerd to prevent people finding out
information which they could use for some other attack (ie: usernames).

As for POP3 I can't remember what exploits there were for it, I guess some
pop3 daemons permitted people to run remote brute force password cracking
attempts since they didn't limit the number of times you could try and log
in so people could just sit there with hundreds of connections to the POP3
port trying every word in the dictionary until they find someone with a
bad password.

In short running any sort of service is going to leave you potentially
vulnerable. Your security program was probably just complaining that you
were running the services at all, rather than that it had detected a
vulnerable server on your machine. All the same you might want to check
out www.cert.org and search for your servers and see if there have been
any reports for them.

Regards,

Robert McKay.

Start your own FREE mailing list at

© 2000 Microsoft Corporation. All Rights Reserved